Help Centre
Getting Started
How to Use
Integrations & SSO
Configuration
Threat Intelligence
Compliance
Patch Applications
Administration
Videos
FAQs
🤖 AI Tour
📦 Patch Applications
Patch Applications (menu → Patch Management → Patch Applications) is the application
lifecycle console: it shows every application installed on every device, whether it is
up to date or out of date against the vendor's current version, and lets your team
patch applications with an Administrator / Global Administrator authorization step,
scheduling and delay, and automatic version verification afterwards.
1 · What you see
📦 ApplicationsEvery installed application per device, with installed vs latest version
💻 DevicesPer-device summary: how many apps are out of date, up to date, critical
⏱️ Patch jobsEvery job, its status, who authorized it, and its results
🏭 Vendor catalogWhat each vendor currently ships, available versions + download links
Status is computed by comparing the installed version against the vendor catalog (e.g. Chrome 116.0 vs the latest 126.0). Applications with no catalog match are marked unknown. The catalog also records patch importance, whether the update touches the registry, and whether a reboot is required.
2 · How patching works (authorization first)
Step 1
Select what to patch
Tick out-of-date applications (or use Patch all on a device) and press Patch now or Schedule.
Step 2
Choose when
Immediate — run as soon as authorized · Schedule — pick a date & time · Delay — run N minutes from now. Add a note (e.g. change window) if useful.
Step 3
Administrator authorizes
If you are an Administrator / Global Administrator the job is authorized immediately. Otherwise an approval request is sent to the Administrators (and to Teams when configured) — only they can Authorize or Reject. Rejected jobs are cancelled.
Step 4
Execute
Once authorized, the job downloads the vendor build and pushes it to the target devices. Scheduled jobs run automatically when due.
Step 5
Verify versions
After execution the installed version is re-checked against the catalog and the application is marked up to date. Use Verify versions to re-scan at any time.
⚠️ Registry warning: some updates (e.g. 7-Zip, Java, Adobe Reader) touch the Windows registry.
ProPera always shows a confirmation popup before creating such jobs and never modifies the registry silently.
3 · Live vs demo mode
| Demo mode | Live (Microsoft) mode | |
|---|---|---|
| Inventory | Realistic sample applications on the demo devices | Pulled from Microsoft Defender software inventory when connected; re-scanned by the worker |
| Execution | Simulated — versions update instantly so you can see the full workflow | Deployment intent + verification recorded; pushing to endpoints uses Intune / SCCM / your deployment tooling |
| Authorization | Identical workflow | Identical workflow — Administrator / Global Administrator only |
4 · Where else it shows up
- Dashboard — Application patch posture card (out-of-date apps, devices needing patches, pending authorizations, scheduled jobs).
- Compliance — the Unpatched devices card links straight to Patch Applications; patching posture feeds the continuous-compliance evidence.
- System Logs — every step (request, authorize, reject, execute, verify, cancel) is recorded with actor, role and result.
- REST API —
/api/patches/*(overview, apps, devices, catalog, jobs) for integration and automation.
5 · Who can do what
| Action | Viewer / Analyst | Administrator / Global Admin |
|---|---|---|
| View inventory, catalog, jobs | ✅ | ✅ |
| Create a patch job (immediate / scheduled / delayed) | ✅ (requires admin authorization) | ✅ (auto-authorized) |
| Authorize / reject a patch job | — | ✅ |
| Execute, verify, cancel a job | ✅ (after authorization) | ✅ |
Permission notes: creating jobs requires view_vulnerabilities; authorizing requires
an Administrator / Global Administrator role (the API enforces this even if a non-admin calls the
endpoint directly). Every action is audited.